seo-geo-optimizer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt shows commands that pass API/indexing keys directly on the command line (e.g., "--key YOUR_KEY"), which would require the agent to accept and emit secret values verbatim in generated commands/outputs, creating an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Phase 3’s serp_analyzer.py/competitive_analyzer.py (and related SERP/feature tracking) fetches public web search results at runtime and then parses/summarizes their page text into the agent’s LLM context, which is outsider-authored free text.